Red Hat Security Advisory: kernel security update

Important

A flaw was found in the Kernel-based Virtual Machine (KVM) for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 (L1) intercepts during the completion of userspace I/O emulation for a Level 2 (L2) instruction. If the L1 or host userspace modifies I/O interception settings during this process, KVM may misinterpret already-emulated I/O as intercepted. This can lead to a kernel warning and potentially disrupt the guest virtual machine, resulting in a denial of service. Exploitation requires local access to /dev/kvm and the ability to perform nested virtualization or manipulate I/O bitmaps.

CWE-754 - Improper Check for Unusual or Exceptional Conditions

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a `privcmd` memory region. This action causes a Virtual Memory Area (VMA) to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed twice, a condition known as a double free, which can cause system instability or a denial of service.

CWE-763 - Release of Invalid Pointer or Reference

A flaw was found in the Linux kernel. The `ipc_idr_alloc()` function, used in the checkpoint/restore path for SysV Inter-Process Communication (IPC) ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a use-after-free vulnerability. This issue could potentially cause system instability or information disclosure.

CWE-825 - Expired Pointer Dereference